Passive email archive

[Miles Stevenson <miles () mstevenson org>]

This is more of a general network sniffer inquiry than snort-specific, but I 
thought it would still be appropriate for this list.

I'm trying to come up with an elegant solution to archiving corporate email 
without mucking with the actual MTA's themselves. My first idea was to just 
use a network sniffer to capture all the inbound and outbound mail traffic 
with specific To and From fields. Capturing the traffic doesn't seem to be 
the problem though. It's the storage part.

It's not very convienent to have the emails saved in a standard dumpfile as 
packets. Too difficult to parse through the archive when you need to find a 
specific email. Anyone have any ideas on how to get a snort/tcpdump/whatever 
to save captured mail traffic as actual text mail files in a maildir type 
format?

-- 
Miles Stevenson
miles () mstevenson org
PGP FP: 035F 7D40 44A9 28FA 7453 BDF4 329F 889D 767D 2F63


-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users